Access Windows Registry from Ubuntu

Question

Is there any way I can access registry of my Windows 7 installation from Ubuntu. I believe that Registry Editor is a GUI to edit various configuration settings which are stored and distributed among multiple files. So I wonder if I can access those configuration from Ubuntu (or any other non-windows OS).

Answer 1

The chntpw tool has (very basic) registry editing capabilities.

Also try the regedit that comes with Wine – you might be able to load the Win7 registry hives into it. The files are:

• Registry: HKLM\SYSTEM

  File: \WINDOWS\system32\config\system

• Registry: HKLM\SOFTWARE

  File: \WINDOWS\system32\config\software

• Registry: HKU\<user-SID> (aka HKCU)

  File: <home>\NTUSER.DAT

• Registry: HKU\<user-SID>_Classes (aka HKCU\Software\Classes)

  File: <home>\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat

  File: <home>\AppData\Local\Microsoft\usrclass.dat – as of Windows Vista

• Registry: HKU\.DEFAULT (the system account)

  File: \WINDOWS\system32\config\default

Note that HKU\.DEFAULT is the system account. It is not the template account.

The template account's files are at \Documents and Settings\Default User (substitute for <home> above).

[self todo: SECURITY, SAM]

Answer 2

Offline NT Password & Registry Editor has a registry editor which works under Linux

• There is also a registry editor and other registry utilities that works under linux/unix, and can be used for other things than password editing

Answer 3

A. reglookup

apt install reglookup

$ reglookup -t BINARY -p \
  /ControlSet001/Services/BTHPORT/Parameters/Keys/4c1d96a0c133/c8478c0b5dd0 \
  /mnt/win10/Windows/System32/config/SYSTEM

PATH,TYPE,VALUE,MTIME
/ControlSet001/Services/BTHPORT/Parameters/Keys/4c1d96a0c133/c8478c0b5dd0,BINARY,%A6%06%9A%01-l%1CI%051%97%86%E3%98g\,

it show binary as % encoded string, not like regedit.

// a js function, to decode it's output // can be run in browser F12 console

function my_decode(val){
  var out = []
  val.match(/%..|./g,'').forEach(function(v){
    var hex = v[0]=='%' ? v.substr(1) : v.charCodeAt(0).toString(16)
    out.push(hex)
  })
  return out.join(',')
}

//usage
my_decode('%A6%06%9A%01-l%1CI%051%97%86%E3%98g\\')
"A6,06,9A,01,2d,6c,1C,49,05,31,97,86,E3,98,67,5c"

or

unescape('%A6%06%9A%01-l%1CI%051%97%86%E3%98g\\')
  .replace(/./g, (x) => ('0'+x.charCodeAt(0).toString(16)).substr(-2)+',')
  .replace(/,$/,'')
"a6,06,9a,01,2d,6c,1c,49,05,31,97,86,e3,98,67,5c"

B. reged

apt install chntpw

$ reged  -x /mnt/win10/Windows/System32/config/SYSTEM \
   'HKEY_LOCAL_MACHINE\SYSTEM' \
   '\ControlSet001\Services\BTHPORT\Parameters\Keys\4c1d96a0c133' /dev/stdout \
    | grep c8478c0b5dd0
"c8478c0b5dd0"=hex:a6,06,9a,01,2d,6c,1c,49,05,31,97,86,e3,98,67,5c

it not output to stdout, so use /dev/stdout.
it can't specify item name, so use grep.

C. hivexget

apt install libhivex-bin

root@archiso ~ # hivexget /mnt/Windows/System32/config/SYSTEM  'ControlSet001\Control\ComputerName\ComputerName'
"@"="mnmsrvc"
"ComputerName"="EPX-VIDYY"

D. hivexregedit

apt install libwin-hivex-perl

root@archiso ~ # hivexregedit --export  /mnt/Windows/System32/config/SYSTEM  'ControlSet001\Services\iaStorV'
Windows Registry Editor Version 5.00

[\ControlSet001\services\iaStorV]
"DriverPackageId"=hex(1):69,00,61,00,73,00,74,00,6f,00,72,00,76,00,2e,00,69,00,6e,00,66,00,5f,00,78,00,38,00,36,00,5f,00,6e,00,65,00,75,00,74,00,72,00,61,00,6c,00,5f,00,31,00,38,00,63,00,63,00,63,00,62,00,38,00,33,00,62,00,33,00,34,00,65,00,31,00,34,00,35,00,33,00,00,00
"ErrorControl"=dword:00000001
"Group"=hex(1):53,00,43,00,53,00,49,00,20,00,4d,00,69,00,6e,00,69,00,70,00,6f,00,72,00,74,00,00,00
"ImagePath"=hex(2):5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,64,00,72,00,69,00,76,00,65,00,72,00,73,00,5c,00,69,00,61,00,53,00,74,00,6f,00,72,00,56,00,2e,00,73,00,79,00,73,00,00,00
"Start"=dword:00000003
"Tag"=dword:00000019
"Type"=dword:00000001

[\ControlSet001\services\iaStorV\Parameters]
"BusType"=dword:00000008
"queuePriorityEnable"=dword:00000000


root@archiso ~ # hivexregedit --export  /mnt/Windows/System32/config/SYSTEM  'ControlSet001\Services\iaStorV' > /tmp/bla.reg
root@archiso ~ # vim /tmp/bla.reg
root@archiso ~ # hivexregedit --merge /mnt/Windows/System32/config/SYSTEM /tmp/bla.reg